Importing and Exporting with AGPM

Thanks for tuning in this lovely Friday! Time for a glimpse into the advanced side of Group Policy, with Advanced Group Policy Management. This awesome product comes as part of MDOP (Microsoft Desktop Optimization Pack), which you can get easily if you have SA. Read more about it here on TechNet. The following article on how to migrate between Controlled and Uncontrolled GPO’s is by Deepak Vishwanathan, a hardworking developer on the Group Policy team.

– superLilia

Now, say your enterprise is using AGPM and has a mixed environment of controlled and uncontrolled GPOs. Let’s say you want to export the settings from your controlled GPO “Sales” and import them into an uncontrolled GPO “Mobile Sales”.

You try, but you fail. Why?

To import settings, the GPMC (Group Policy Management Console) is expecting a GPMC backup. But the AGPM export output is not a GPMC backup.The output of AGPM export operation is a cabinet file, whereas the output of GPMC backup operation is a GPO backup directory tree. So, we need a mechanism to convert the AGPM cabinet file into a GPO backup directory tree, so it can be imported by the GPMC.

The same problem happens in the reverse: if you want to import settings of an uncontrolled GPO into an AGPM-controlled GPO. The input to the AGPM import operation is a cabinet file, whereas the output of GPMC backup operation is a GPO backup directory tree. Again, we need to convert from GPO backup directory tree to AGPM import cabinet file.

· While decompressing, we need to ensure that the filepaths for the compressed files are retained. To ensure this, we use the –p (path preserve) option.

Once the command is executed, the decompressed GPO Backup root directory would be d:uncontrolledGPObackups{3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9} (assuming, {3D92F8A6-21DD-4BF9-B153-0CD5FF5539C9} is the exported GPO’s backupId).